---
title: "Automated Internal PKI with Ephemeral X.509 Certificates | Zero-Trust Architecture Canon"
description: "HashiCorp Vault PKI motoru ile çalışan, 1 saatten kısa ömürlü geçici X.509 ve SSH sertifikaları üreten ve sıfır dokunuşla otomatik rotasyon sağlayan dinamik iç PKI mimarisi."
image: "https://tinycto.tv/assets/zero-trust/zero_trust_architectures_og.jpg"
canonicalUrl: "https://tinycto.tv/tr/zero-trust/architectures/pki-vault-short-lived-certs"
locale: "tr"
---

# Automated Internal PKI with Ephemeral X.509 Certificates (`zt-arch-14`)

> **Sütun**: IDENTITY | **Arketip**: IDENTITY_ATTESTATION
> **Engellenen MITRE ATT&CK Teknikleri**: T1552.004, T1098.004, T1021.004

## Mimari Özeti

HashiCorp Vault PKI motoru ile çalışan, 1 saatten kısa ömürlü geçici X.509 ve SSH sertifikaları üreten ve sıfır dokunuşla otomatik rotasyon sağlayan dinamik iç PKI mimarisi.

## Saldırgan Modeli

Saldırganın iç TLS özel anahtarını veya SSH anahtarını çalarak sisteme uzun vadeli kalıcı erişim sağlamaya çalışması.

## NIST SP 800-207 Temel İlkeleri

- Access to individual enterprise resources is granted on a per-session basis.
- All communication is secured regardless of network location.

## 3 Kademeli Olgunluk Yapılandırmaları

### INITIAL Seviyesi

- **Uygulama Kapsamı**: Vault PKI issuing 30-day internal TLS certificates for microservices.
- **Kimlik Doğrulama Zorlaması**: Vault AppRole authentication from Kubernetes deployment secrets.
- **Ağ İzolasyonu**: Vault accessible over private VPC network.

### ADVANCED Seviyesi

- **Uygulama Kapsamı**: Sub-hour ephemeral certificates (TTL 60 min) managed via cert-manager Vault issuer.
- **Kimlik Doğrulama Zorlaması**: Kubernetes Service Account JWT authentication with automatic identity binding.
- **Ağ İzolasyonu**: Mutual TLS enforced between cert-manager and Vault cluster.

### OPTIMAL Seviyesi

- **Uygulama Kapsamı**: Multi-datacenter Vault replication with automated CRL generation and short-lived SSH client certs.
- **Kimlik Doğrulama Zorlaması**: Sub-15-minute certificates; zero persistent private keys stored on disks anywhere.
- **Ağ İzolasyonu**: Hardware Security Module (HSM) rooted offline Root CA with automated intermediate generation.

## Terraform HCL Manifest

```hcl
resource "vault_mount" "pki" {
  path        = "pki_int"
  type        = "pki"
  description = "TinyCTO Ephemeral Intermediate PKI"
  default_lease_ttl_seconds = 3600
  max_lease_ttl_seconds     = 86400
}

resource "vault_pki_secret_backend_role" "role" {
  backend          = vault_mount.pki.path
  name             = "tinycto-microservices"
  ttl              = 3600
  allow_ip_sans    = true
  key_type         = "ed25519"
  allowed_domains  = ["internal.tinycto.tv"]
  allow_subdomains = true
}
```

## Kubernetes / Tetragon Policy Manifest

```yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: order-service-tls
  namespace: production
spec:
  secretName: order-service-tls
  duration: 1h
  renewBefore: 15m
  issuerRef:
    name: vault-issuer
    kind: ClusterIssuer
  commonName: order-service.internal.tinycto.tv
  dnsNames:
  - order-service.internal.tinycto.tv
```


```json
{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "Automated Internal PKI with Ephemeral X.509 Certificates | Zero-Trust Architecture Canon",
  "description": "HashiCorp Vault PKI motoru ile çalışan, 1 saatten kısa ömürlü geçici X.509 ve SSH sertifikaları üreten ve sıfır dokunuşla otomatik rotasyon sağlayan dinamik iç PKI mimarisi.",
  "url": "https://tinycto.tv/tr/zero-trust/architectures/pki-vault-short-lived-certs"
}
```